How seed phrases work
The BIP-39 standard (Bitcoin Improvement Proposal 39) specifies:
- The wallet generates random entropy (128 bits for 12-word seeds, 256 bits for 24-word).
- A checksum is appended; the combined bits are divided into 11-bit groups.
- Each 11-bit group maps to a word from the 2,048-word BIP-39 wordlist.
- The seed phrase is deterministically converted back to entropy on recovery, then to a master seed, then to private keys via BIP-32 hierarchical deterministic (HD) derivation.
The upshot: your 12 or 24 words, entered into any BIP-39-compatible wallet, regenerate the identical address tree. You can move between wallets (MetaMask → Rabby → hardware) with the same seed.
Entropy and security
- 12-word seed = 128 bits of entropy. Computationally unbreakable by any plausible attack.
- 24-word seed = 256 bits of entropy. Quantum-resistant buffer against potential future attacks on 128-bit security.
For practical purposes, 12 words is sufficient. 24 is marginally more future-proof at the cost of longer backups.
Seed-phrase storage
The canonical rules:
- Write it down physically. Metal plates (Cryptosteel, Billfodl) are fireproof and water-resistant.
- Store in multiple secure locations. Bank safe deposit box + home safe + trusted family member; at least 2 locations, ideally separated by geography.
- Never type it into any internet-connected device except your wallet during setup or recovery.
- Never store it digitally — no photos, no password managers (for most users), no cloud backup.
- Test recovery once. Verify that the words work before trusting them with real balance.
- Include in estate plan so heirs can access if you’re incapacitated. Include the location of the backup + recovery procedure.
Advanced patterns
- Passphrase (25th word) — an additional user-chosen word layered on top of the BIP-39 seed. Creates “hidden wallets” that require both the 24-word seed AND the passphrase to recover. Protects against seed-phrase discovery during home break-in: you can reveal the non-passphrase wallet (which shows a small balance) while the real balance is behind the passphrase.
- Shamir backup (SLIP-0039) — split the seed into N shares where any M can reconstruct it. Trezor supports natively. Distributes risk: no single share can recover the wallet, so a single-location loss isn’t catastrophic.
Risks and considerations
- Social engineering — “wallet support” asks for your seed to verify identity. Never legitimate.
- Seed written near the wallet — a thief finding both the device and the seed phrase at the same location defeats the purpose.
- Generic cloud leaks — seed phrases typed into “wallet tracker” or “portfolio manager” apps get aggregated by service operators, sometimes breached.
- Seed-sharing with partners — couples often share a seed; in acrimonious separations this becomes a dispute. Multisig is a cleaner structure for shared funds.
- Accidental sharing via support channels — Discord/Telegram scammers impersonate project support; “verify your wallet by pasting your seed” is one of the most common phishing templates.
The absolute rule: your seed phrase is the single most sensitive piece of information you own. Everything else — passwords, 2FA codes, API keys — can be rotated. A compromised seed phrase is permanent loss of all associated funds.